Pass NSE7_SDW-7.2 Exam - Real Test Engine PDF with 96 Questions
Get New NSE7_SDW-7.2 Certification Practice Test Questions Exam Dumps
Fortinet NSE7_SDW-7.2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 14
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must enable net-device.
- B. You must set ike-version to 1.
- C. You must enable auto-discovery-sender.
- D. You must disable idle-timeout.
Answer: A
NEW QUESTION # 15
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs traffic shaping on YouTube traffic?
- A. Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.
- B. Web filtering must be enabled on the firewall policy.
- C. Destination internet service must be enabled on the traffic shaping policy.
- D. Application control must be enabled on the firewall policy.
Answer: B
NEW QUESTION # 16
Refer to the exhibits.
Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.
Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.
The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.
However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.
Based on the exhibits, which configuration change is required to fix issue?
- A. In the BGP neighbor configuration, apply the route map dcl-lab-rm in the outbound direction.
- B. In SD-WAN rule ID 1, change the destination to use ISDB entries.
- C. In the dcl-lab-rm route map configuration, set set-route-tag to 10.
- D. In the dcl-lab-rm route map configuration, unset match-community.
Answer: A
NEW QUESTION # 17
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?
- A. When T_INET_0_0 has 4% packet loss.
- B. When all three members have the same packet loss.
- C. When T_INET_1_0 has 4% packet loss.
- D. When T_INET_0_0 has 12% packet loss.
Answer: C
NEW QUESTION # 18
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)
- A. FortiGate flags the sessions as dirty.
- B. FortiGate performs a route lookup for the original traffic only.
- C. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
- D. FortiGate continues routing the sessions with no SNAT, over port2.
Answer: C,D
NEW QUESTION # 19
Which statement about using BGP routes in SD-WAN is true?
- A. You must use external BGP.
- B. Learned routes can be used as dynamic destinations in SD-WAN rules.
- C. You must configure AS path prepending.
- D. You must use BGP to route traffic for both overlay and underlay links.
Answer: B
NEW QUESTION # 20
Which two statements about SLA targets and SD-WAN rules are true? (Choose two.)
- A. SLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy.
- B. Member metrics are measured only if an SLA target is configured.
- C. When configuring an SD-WAN rule, you can select multiple SLA targets of the same performance SLA.
- D. SD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements.
Answer: B,D
NEW QUESTION # 21 
Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
- B. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
- C. The measured bandwidth is less than 100 KBps.
- D. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
Answer: C,D
NEW QUESTION # 22
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- B. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- C. The number of simultaneous connections allowed for each source IP address cannot exceed five connections.
- D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
Answer: A,C
NEW QUESTION # 23
Refer to the exhibit.
Based on the exhibit, which action does FortiGate take?
- A. FortiGate bounces port5 after it detects all SD-WAN members as dead.
- B. FortiGate fails over to the secondary device after it detects all SD-WAN members as dead.
- C. FortiGate brings down port5 after it detects all SD-WAN members as dead.
- D. FortiGate brings up port5 after it detects all SD-WAN members as alive.
Answer: B
NEW QUESTION # 24
Refer to the exhibit.
Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)
- A. Cost
- B. Priority
- C. Gateway IP
- D. Interface member
Answer: C,D
NEW QUESTION # 25
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- B. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
- C. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- D. The packet size exceeded the outgoing interface MTU.
Answer: A
Explanation:
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message "Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
NEW QUESTION # 26
Refer to the exhibit.
Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?
- A. All traffic from a source IP is sent to the most used interface.
- B. All traffic from a source IP is sent to the same interface.
- C. All traffic from a source IP to a destination IP is sent to the least used interface.
- D. All traffic from a source IP to a destination IP is sent to the same interface.
Answer: D
Explanation:
Study Guide 7.2, page 176.
NEW QUESTION # 27
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
- B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- C. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
- D. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
Answer: D
NEW QUESTION # 28
Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available
bandwidth?
- A. Shared-policy shaping mode
- B. Per-IP shaping mode
- C. Reverse-policy shaping mode
- D. Interface-based shaping mode
Answer: D
Explanation:
Explanation
Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.
NEW QUESTION # 29
Refer to the exhibit.
Based on the output, which two conclusions are true? (Choose two.)
- A. The SD-WAN rules take precedence over regular policy routes.
- B. There is more than one SD-WAN rule configured.
- C. Entry 1(id=1) is a regular policy route.
- D. The all_rules rule represents the implicit SD-WAN rule.
Answer: B,C
NEW QUESTION # 30
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Specify a unique peer ID for each dial-up VPN interface.
- B. Use different proposals are used between the interfaces.
- C. Configure the IKE mode to be aggressive mode.
- D. Use unique Diffie Hellman groups on each VPN interface.
Answer: A,C
NEW QUESTION # 31
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?
- A. Host 8.8.8.8 is reachable through port1 and port2.
- B. FortiGate removes all static routes for port2.
- C. The administrator manually restores the static routes for port2, if port2 becomes alive.
- D. Port2 becomes alive after three successful probes are detected.
Answer: B
Explanation:
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead
NEW QUESTION # 32
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- B. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- C. The number of simultaneous connections allowed for each source IP address cannot exceed five
connections. - D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
Answer: A,C
NEW QUESTION # 33
Which are three key routing principles in SD-WAN? (Choose three.)
- A. Regular policy routes have precedence over SD-WAN rules.
- B. SD-WAN rules have precedence over ISDB routes.
- C. FortiGate performs route lookups for new sessions only.
- D. By default, SD-WAN members are skipped if they do not have a valid route to the destination.
- E. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
Answer: A,D,E
Explanation:
Explanation
Study Guide 7.2, pages 125, 129, 151
NEW QUESTION # 34
Refer to the exhibit.
Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)
- A. Cost
- B. Priority
- C. Gateway IP
- D. Interface member
Answer: C,D
NEW QUESTION # 35
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?
- A. When all three members have the same packet loss.
- B. When T_INET_0_0 has 4% packet loss.
- C. When T_INET_1_0 has 4% packet loss.
- D. When T_INET_0_0 has 12% packet loss.
Answer: A
NEW QUESTION # 36
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?
- A. exchange-interface-ip must be enabled.
- B. add-route must be disabled.
- C. mode-cfg must be enabled.
- D. type must be set to static.
Answer: B
NEW QUESTION # 37 
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.
Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- A. In the firewall policy, select Proxy-based as Inspection Mode.
- B. In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.
- C. In the traffic shaping policy, select Assign Shaping Class ID as Action.
- D. Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.
Answer: B
NEW QUESTION # 38
Which two performance SLA protocols enable you to verify that the server response contains a specific value?
(Choose two.)
- A. dns
- B. http
- C. twamp
- D. icmp
Answer: A,B
Explanation:
Performance SLA (Service Level Agreement) protocols are used in SD-WAN to monitor the quality and performance of various network services. The two protocols that specifically allow for verifying a specific value in the server response are:
* HTTP (Hypertext Transfer Protocol): HTTP is the foundation of data communication on the World Wide Web. It allows for fetching resources, such as HTML documents. You can configure an HTTP performance SLA to send specific requests (e.g., GET or POST) and then check if the response body contains a particular string or value. This is useful for validating web server functionality and content delivery.
* DNS (Domain Name System): DNS is responsible for translating domain names into IP addresses. A DNS performance SLA can be set up to query a specific domain and verify that the returned IP address or other DNS record values match what is expected. This helps ensure proper name resolution and accessibility of resources.
NEW QUESTION # 39
......
NSE7_SDW-7.2 Exam Dumps - PDF Questions and Testing Engine: https://guidetorrent.dumpstorrent.com/NSE7_SDW-7.2-exam-prep.html